Recent, well publicized, security breaches have highlighted the need for improved security techniques to protect consumer privacy and secure digital assets. Examples of organizational victims of cybercrime include well known companies that typically have traditional Web security in place, yet cyber criminals have still been able to obtain personal data from financial, healthcare, retail, and academic Web sites. Organizations that have publicly confirmed exposure of client or customer information put the figure at over 500,000 people who were victims of cybercrime in 2005, and those are the organizations that have publicly confirmed a security breach. It is highly likely that more organizations were also impacted, but did not reported it, and more troubling yet, other organizations may have had information leakage but are completely unaware of the situation.
Organizations can not afford negative brand image, credibility damage, legal consequences, or customers losses. In one example, in June 2005 MasterCard and Visa reported that a third party processor, CardSystems, had exposed credit card transaction records of approximately 40 million people that included names, card numbers and security codes. The CardSystems situation is an unfortunate example of how a single security breach can materially impact a business, yet it is also a wake up call for anyone doing business online.
The disclosure of some of these Web security breaches has led law enforcement to determine, after careful investigation, that cybercrime is being driven by organized crime. This is very different than the bright kid-next-door trying to break into a system to prove bragging rights. Targeted rings of well educated and sophisticated hackers have been uncovered, often in countries where prosecuting them is a challenge. Contributing to the increase in cybercrime is the ease with which these organized cyber criminals can target, and hack, a Web application from anywhere in the world with simple Internet access.
Properly securing Web applications and the data behind them is a critical component to doing business on the Web. Often, some of the most valuable organizational data is served through a Web browser making it more important than ever to safeguard this information from cybercriminals.
Need for Increased Security
In response to increased cybercriminal activity, government regulations for privacy and accountability mandate a standard of security, and customer notification if personal data is lost or stolen. In the U.S., many states have enacted a form of the Information Security Breach Act and other states have similar pending privacy legislation. As new disclosure standards emerge, consumers expect to be notified in the event of a security breach. Organizations are motivated by government regulations or consumer expectations to incorporate the necessary security measures to safeguard data. Organizations also desire to demonstrate, through security audits, that reasonable due care is taken to protect customer and financial information and that customers are notified in the event of a data theft or loss.
Some industries, such as the credit card industry, have created their own security standards to proactively address the need for managing customer data more securely and consistently. The Payment Card Industry (PCI) Data Security Standard requires Master-Card merchants to protect cardholder data, encrypt transmissions and stored data, and develop and maintain secure systems and applications. (See “Payment Card Industry Data Security Standard” at URL https://sdp.mastercardintl.com/pdf/pcd_manual.pdf (January 2005).
Similarly, the VISA Cardholder Information Security Program (CISP) requires compliance to its standards for all entities storing, processing, or transmitting cardholder data. For example, VISA merchants must prove CISP compliance, follow outlined disclosure policies in the event of data theft of loss, and are subject to hefty financial penalties (up to $500,000 per incident) for non-compliance. (See “VISA Cardholder Information Security Program” at URL http://usa.visa.com/business/accepting_is a/ops_risk_management/cisp_merchants.html.)
Because the number of notification laws to be enacted is likely to increase, organizations are motivated to improve and validate existing security measures that protect the organization from Web threats and to demonstrate to regulators and stakeholders that security is interwoven into the business operations.
Shortcomings in Existing Security Measures
The growth in popularity and general acceptance of the Web as a network for commerce and communications has been unprecedented. However, security was not part of the original design of the Web so it is susceptible to security breaches. Further exacerbating the lack of security measures in the original design of the Web, many organizations are aggressively moving applications to the Web that were originally created for an internal network environment. The push to make applications available sometimes outweighs thorough security testing of the applications, and potentially opens the door to unanticipated vulnerabilities being uncovered once the application is available on the Internet.
Before Web applications became so popular sensitive information was typically stored in databases and applications on internal networks. Cybercriminals, such as hackers, wanting to obtain this information would have to gain access to the data by breaking into servers deeper and deeper within an organization's network until they found something useful. Network security solutions, such as firewalls and intrusion detection systems, were designed to meet this threat.
As applications have moved to the Web, hackers have shifted their strategy from attacking organizations by searching for vulnerable servers that can be compromised, to targeted attacks against Web applications. The use of Web applications provides a front-end to an organization's mission-critical data. Hackers no longer need to search through a network to find the data they are looking for, they can now simply browse an organization's Web site. In addition, each of the applications is different and thus, cannot typically be protected by generic measures as was possible for traditional network security solutions. Generally, each Web application requires protective measures tailored to its specific needs.
A common misconception in Web security is that using Secure Sockets Layer (SSL) will protect a Web application from attacks. While SSL supports secure transmission of sensitive information, it does not protect a Web application from attack. Attacks can be sent using SSL and the SSL transmission goes through firewalls because the firewall will usually have a port, typically port 443, open to permit SSL traffic. Using SSL provides protection for data during transmission, but it does not afford protection from attacks against the Web application, such as SQL Injection discussed further below. Many hackers have discovered that by sending attacks through SSL, they can circumvent network security because these network devices are unable to view this encrypted data.
Prior, or first-generation, application protection solutions or application firewalls followed the same paradigm as network firewalls. In these types of solutions, a negative, or list-based, model of application level threats is used to screen for potential application-level attacks. However, because each application is unique, a list-based or negative security model is generally not effective at securing the Web application from attacks.
Thus, there is a need for improved systems and techniques to protect Web applications from security breaches.